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Abstract —Privacy in Online Social Networks (OSNs) evolved 
from a niche topic to a broadly discussed issue in a wide variety 
of media. Nevertheless, OSNs drastically increase the amount of 
information that can be found about individuals on the web. To 
estimate the dimension of data leakage in OSNs, we measure 
the real exposure of user content of 4,182 Facebook users from 
102 countries in the most popular OSN, Facebook. We further 
quantify the impact of a comprehensible privacy control interface 
that has been shown to extremely decrease configuration efforts 
as well as misconfiguration in audience selection. 

Our study highlights the importance of usable security, (i) The 
total amount of content that is visible to Facebook users does 
not dramatically decrease by simplifying the audience selection 
interface, but the composition of the visible content changes, (il) 
Which information is uploaded to Facebook as well as which 
information is shared with whom strongly depends on the user’s 
country of origin. 

Index Terms —Social Networks, Privacy Control, Facebook 


I. Introduction 


Online Social Networks (OSNs), such as Facebook or 
google-H, have about one billion user^in 2015. OSNs allow 
their users to create and maintain a personal user profile and 
connect this profile with others by declaring friendship rela¬ 
tions. Amongst communication functionalities, sharing content 
and personal information is the core of OSN sites. Content 
sharing serves communication and self-expression needs of 
OSN users, but raises privacy concerns at the same time. 

There is an ongoing discussion about how to handle those 
privacy concerns. The CEOs of Google and Facebook argue 
that we live in a post-privacy world 12, Uj- We shall accept 
the fact that there is no privacy anymore and adapt ourselves 
to the new situation. On the other side of the discussion 
spectrum, privacy advocates fear oversharing of content ifTSl to 
avoid undesired effects such as that employers are accessing 
private information to draw undesired conclusions. In spite 
of this discussion, the real privacy preferences of the social 
networking community are still not entirely known. 

Studying the actual privacy settings of Facebook users (e.g. 
lfT2 l does also not tell the whole story about content sharing 
and privacy preferences, since users are commonly unable to 
select the desired audience El, El- We thus developed a 
color-based interface to simplify the audience selection for 
user content in Facebook (Figure detailed description in 
Section III-B i. This interface is shown to drastically decrease 


’http://allfacebook.de/userdata/. Accessed 2015-03-06 


both the effort and the error probability when handling privacy 
settings US). 


Birthday: November 22,1978 


□ □□ 


Fig. 1. Example for an attribute’s privacy setting (User’s Birthday) 


This color coding-based interface is published in the shape 
of an add-on (plug-in) for the Firefox and Chrome browsers 
and made available to the public over various channels on the 
web. This plug-in is called Facebook Privacy Watcher (FPW). 
Several newspapers, blogs and even radio and TV stations 
reported about if][^ More than 44,000 users downloaded the 
FPW. 

We asked the FPW users to send us anonymized feedback 
with consent, to improve the plug-in and to evaluate the impact 
of the plug-in on user’s privacy. We received 9,296 feedback 
responses originated from 102 countries. These responses in¬ 
cluded the privacy settings of the user profiles and the changes 
that were made with the help of our plug-in. Furthermore, we 
received the number of friends, photos, likes, notes and map 
entries as well as the binary information for each user profile 
data field (denoted profile field in the remainder) whether it is 
filled with data or not. 

Based on this dataset, we evaluate the real exposure of 
private user data in Facebook and the content sharing pref¬ 
erences of the FPW users. We evaluate the privacy settings 
before and after introducing a comprehensible visualization 
of privacy handle as well as the changes that have been 
performed. By reason that the results strongly differ with 
respect to different countries, we also performed evaluations 
that focus on national differences. Assuming that increasing or 
decreasing the visibility of parts of the user profiles expresses 
the desires of users to have more or less privacy, we compared 
the user profiles of users who use the FPW to achieve more 
privacy with those who decided to publish more private data. 

Our results indicate that we indeed do not live in a post 
privacy world; The users intentionally hide content from being 
publicly accessed and do not accept the default privacy settings 
even before using our plug-in. With the help of the FPW, users 
hide critical data fields such as friend lists and family member 

^ http://www.masrawy.com/news/Technology/General/2012/October/31/ 
5420245.aspx Accessed 2015-03-06 

'http://www.golem.de/news/facebook-firefox-erweiterung-macht-die- 
privatsphaere-bunt-1212-96091.html Accessed 2015-03-06 





markers but publish birthdays and religious views. The total 
amount of content which is visible to Facebook users does 
not dramatically decrease after introducing a comprehensible 
visualization of privacy controls, but the composition of the 
visible content changes. The content sharing patterns are 
strongly depending on their country of origin. 

Our contributions in this paper are (i) to provide an un¬ 
derstanding of the content sharing preferences of FPW users 
both in general and (ii) with respect to different countries and 
(iii) to explain and quantify the effect of improved usability of 
privacy interfaces on privacy settings. We further (iv) depict 
relations between privacy preferences and prohle properties 
by means of cluster analyses. An important highlight is that 
we are not limited to public-available data. Due to the FPW 
feedback data, we can take the user prohle owner’s point of 
view on her privacy settings. 

The remainder of the paper is organized as follows; We 
discuss the related work in Section |n| and provide a detailed 
data description in Section III In Section IV we evaluate the 
privacy settings of FPW users and the impact of introducing a 
comprehensible audience selection without mentioning coun¬ 
try specihc differences. Because of vast differences amongst 
users from different countries, we provide a deeper analysis 
of those specihcs in Section |V] The relation between sharing 
preferences and quantihable user prohle properties such as the 
numbers of friends, likes and photos are evaluated in Section 
|vg We summarize our hndings and conclude our work in 
Section IVIII 


II. Related Work 

Privacy is a topic that is broadly addressed by plenty of 
publications in computer science. In this section, we discuss 
works on privacy in OSNs with the focus on user behavior 
and interface construction in OSNs rather than systems or 
algorithms. Since we discuss a new privacy settings interface, 
default privacy settings and privacy awareness in this paper, 
we particularly focus on papers about privacy by design as 
well as on papers suggesting interfaces for privacy settings in 
OSNs. 

Works on privacy by design are built on the assumption that 
people do not tend to change their privacy settings. Gross and 
Acquisti state that "We can conclude that only a vanishingly 
small number of users change the (permissive) default privacy 
preferences" mi. Based on this logic, the authors suggest to 
implement default privacy rules that prevent leakage of data. 
In contrast to this paper, we evaluate how much a better 
interface helps the users to meet their needs by avoiding 
misconhguration, and compare the sharing preferences with 
respect to the user’s country of origin. Furthermore, our results 
show that more than 59% of the privacy settings do not stay 
untouched in case of using our plug-in. 

In 2008, Krishnamurthy and Wills QIl examined privacy 
settings in Facebook, Myspace, Bebo and Twitter based on 
crawler-gathered data. They discovered that there is some use 
of privacy settings but there is still a signihcant portion of 
users who allow strangers to access private information. They 


further examined the amount of information which is shared 
within regional networks and discovered a negative correlation 
between network size and the amount of shared information. 
In comparison to ifT^ . we focus on Facebook, obtain our data 
directly from the uses, evaluate the impact of our color-based 
privacy setting interface and get different results regarding the 
users disposition to change privacy settings. 

Stutzman et al. monitored the public-available data of 
5,076 members of the Carnegie Mellon University from 2005 
till 2011. They discovered an increasing privacy awareness 
over time. Johnson et al. in surveyed 260 participants from 
the United States, recruited via ResearchMatch, by using a 
Facebook application. They asked questions with the back¬ 
ground knowledge which was obtained by reading the partici¬ 
pant’s Facebook prohle via API. Inter aha, they discovered that 
94.6% of their participants denied access to their content by 
people outside their friend network. Mondal et al. m studied 
the use of social access control lists (SACLs). The friend 
list usage of 1,165 users of tool “Friendlist Manager”, has 
been analyzed. They found “that a surprisingly large fraction 
(17.6%) of content is shared with SACLs. However, we also 
hnd that the SACL membership shows little correlation with 
either prohle information or social network links; as a result, 
it is difficult to predict the subset of a user’s friends likely to 
appear in a SACL.” 

Beside the FPW, other approaches to help users to mitigate 
the misconhguration exist, too. Lipford et al. M suggest to 
allow users take the point of view of the expected audience. 
PViz IITtII is a privacy setting approach based on visualizations 
group visualizations in different granularities. Carminati et al. 
m suggest rule-based privacy settings that dehne types of 
relationships and a set of rules which type of relationship is 
a precondition to access a certain data object. Fang et al. fTlI 
propose a machine learning based approach which implements 
a wizard that suggests a set of access rules. The idea is to learn 
implicit rules which are applied by users to set the visibility 
of objects. In contrast, our interface allows both: to quickly 
grasp the visibility of content items based on a color coding 
and to change those settings with a single click. 

Other related work can be found in studies about Facebook 
user statistics EH, a reporjj about the evolution of privacy in 
Facebook and a survey in llTOl where consumers have been 
asked which information they consider to be private. ED, 
Gl also contain cross-country comparison. However, the user 
statistics do not provide information about privacy settings and 
the consumer survey does rely on questionnaires without a 
concrete link to social networks. 

III. Experimental Setup and Dataset Description 

In this section, we specify the setup of our study by de¬ 
scribing our ethical considerations, the browser extension FPW 
which has been used to collect the data and the precise data 
collection methods. To underline the adequacy of our color¬ 
coding audience selection interface to be used in this study, 

'^http://mattmckeon.com/facebook-privacy/, Accessed 2015-03-06 
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we describe essences on the feedback from study participants. 
We further depict which and how much data we were able to 
collect in this study and describe basic user profile statistics of 
the participants. The bias as a result of a non-random selection 
of study participants is also discussed in this section. 

A. Ethical Considerations 

We protect the privacy of our study participants! Neither the 
download logfile which we used to estimate the dissemination 
of the FPW, nor the feedback answers that we collected are 
linked to individuals. For this study, we asked the FPW users 
to send us feedback with consent. We explained the reason for 
collecting the data and allowed users to access and verify the 
data before sending it to our server. All feedback responses 
that we used in this study are anonymized. We keep the 
collected data confidential to protect all study participants from 
deanonymization attempts and do only publish aggregated 
data. 

B. The Facebook Privacy Watcher 

In Facebook, the user can choose between a number of 
visibility-levels for each information in her profile, namely: 
’Everyone’, ’Friends’, ’Custom’ and ’Only me’. The ’Custom’ 
setting allows users to authorize single friends or groups of 
friends (e. g., ’colleagues’ and ’good friends’) to access certain 
information. In previous work 021 , a new type of interface has 
been presented, which is based on a color coding (Figure [^. 
The used colors are guided by the well-known traffic light 
colors, adding blue to represent custom settings. Results of 
changes (initiated by clicking at the respective color box) are 
shown instantly for direct success control of each action. We 
used the following color scheme: 

• Red: Visible to nobody 

• Blue: Visible to selected friends 

• Yellow: Visible to all friends 

• Green: Visible to everyone 



Michaels albums 
Show comments 


2 albums 


Hamburg - 
Impressions 
11 photos 


Profile Pictures 
1 photo 


Bachelor party 
8 photoa 


Fig. 2. Screenshots of photo albums, colorized by the FPW 

This color scheme is in-line with the sympathy of the ma¬ 
jority of the users (Section [lII-D[ ). Figureshows a screenshot 
of colorized photo albums as an example for colorized profile 
fields. Clicking at the colorized boxes changes the privacy 
settings. A tooltip helps the users to remember the meaning 
of each color. The color scheme can be adopted to individual 
user needs. To help color-blind FPW users, we included the 
possibility to use different stripy patterns instead of colors. 


The FPW has support for English, German, Erench, Italian 
and Arabic. 

C. Data Collection 

We gathered data about the EPW from two sources. The first 
is the download log file at our own server, where the plug-in 
can be downloaded from. The second source of data is the set 
of feedback responses which have been sent to us. While the 
hrst source gives us insights into the spreading process of the 
plug-in, the second source allows us to draw a picture of the 
plug-in usage as well as its impact on privacy settings of the 
users’ profiles. 

1) Download Log: Analyzing the download logfile enabled 
us to understand the time and locality dimensions of the EPW 
dissemination. We discovered strong peaks subsequently to 
the moments of publication in different venues as well as 
that a large user basis is originated in Germany and Egypt. 
We further discovered a couple of sites, offering to download 
our plug-irjj] Thus, we only have an incomplete view on the 
actual downloads by analyzing our own download log. Some 
of those alternative download sites publish the number of 
downloads. Adding the number of downloads from our site 
to those external download counters, we estimate the total 
number of download to be higher than 44,800, coming at least 
from 102 countries. One year after our first EPW publication, 
11,000 users are still following every update that we offer. 

2 ) User Feedback: The usual life-cycle of an EPW instance 
starts with the installation process and resumes with a check of 
the privacy settings of the own profile during a few sessions (1- 
5). The plug-in is sparely used afterwards. We asked our users 
to provide us feedback after activating the plug-in three times, 
which usually happened within the first days after installation. 

We asked for feedback about both: the general idea of 
coloring the profile items to simplify the privacy settings and 
the implementation of our plug-in. Eurthermore, we offered 
two text fields to enter comments and suggestions concerning 
the idea as well as the implementation. We explicitly informed 
our users about the exact (anonymized) data that we collected. 
Erom 2012-10-15 till 2014-07-07, we received 9,296 feedback 
responses from 4,182 users in 102 countries that included col¬ 
oring and log file information. We received multiple answers 
from users in Germany. We asked German users twice to give 
us Eeedback: once - in German language - at the time before 
the EPW was internationally spread and a second time after 
introducing multiple language packs. We used the more recent 
feedbacks to replace older onces in the analysis in case of 
multiple copies from the same user. 

We collected the following information from our users: 

• a hash value of the Eacebook - UIN 

• the counter (including timestamps), indicating how often 
the plug-in was activated 


-http://www.chip.de/downloads/Facebook-Privacy-Watcher-fuer- 

Firefox_57997141.html,Accessed2015-03-06 

http://www.computerbild.de/download/Facebook-Privacy-Watcher- 
7834052.html,Accessed2015-03-06 
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Country 

# Feedback responses 

Germany 

7,581 

Egypt 

272 

Austria 

218 

United States 

150 

Switzerland 

147 

France 

94 

Spain 

72 

Netherlands 

62 


TABLE I 

The number oe Feedback responses that we received erom the 
TOP EIGHT countries 


During this time, we received most of the negative ratings. 
Furthermore, we suffered from a bug in the first version that 
delayed the Facebook usage. 


Rating 

Percentage 

Very good 

32.34 

Good 

61.34 

Medium 

3.44 

Bad 

1.83 

Very bad 

1.05 


TABLE II 

How DO YOU LIKE THE IMPLEMENTATION OE THE FPW? 


• the visibility of each profile field before the first usage 
of our plug-in happened 

• the visibility of each profile field after using our plug-in 

• the type and visibility of timeline entries 

• the number of friends 

• the number of photos and labels 

• the number of likes 

Furthermore, our server, which gathered the feedback data, 
ran a script to extract the countries from which we received 
the feedback. 

D. Users ’ Acceptance of the FPW 

It is essential for the success of the study that participants 
are willing integrate the tool in their normal OSN usage and 
to use it more than only once. The FPW and the realized user 
interface hence need to be both: beneficial for the participants 
and easily usable. Thus, the first question which we asked our 
users in the feedback formula was: ’How do you like the idea 
of colorizing in this plug-in?’. The overwhelming majority 
rated this idea as ’very good’ (65.66%) or ’good’ (32.2%). 
Less than one percent rated the idea to be ’medium’ (0.98%), 
’bad’ (0.46%) or ’very bad’ (0.7%). 

Creating the color scheme, we argued in the team which 
type of color scheme is more intuitive to the users: green, 
inspired by traffic lights meaning ’go’ - corresponding in 
the color scheme to be visible to everybody or green in the 
meaning of being safe since the item is not visible to anybody. 
This question has been asked in the previous user study with 
40 participants. 60% of the participants preferred the green to 
represent the setting meaning ’visible to everybody’. It roughly 
meets the results in this study (54.83% vs. 45.17%). Please 
note: The FPW equally offers both color schemes and the 
users are asked to choose in advance. The setting can later 
be changed. Color blind people have been offered to choose 
hachures instead of colors. 

The second question that we asked the FPW users was: 
’How do you like the implementation of this browser exten¬ 
sion?’ . The implementation was not rated as good as the idea 
of using colors for setting privacy (Table 0- Evaluating the 
comments, we can find the following reasons: The plug-in 
did not work from 7th of November 2013, 2:30 am, till 8th of 
November, 3:30 (am, CET), because of Eacebook site changes. 


E. Sample Bias and Basic User Profile Statistics 

We recruited our sample (EPW users) via an announcement 
on our homepage and by sending press releases to specialized 
press. We then witnessed a viral spreading process based on 
word-of-mouth advertising. The attention of mass media such 
as news paper^ radio station^and an Egyptian web portal 11 
followed afterwards. In spite of the broad audience of the re¬ 
spective media, the set of participants is by no means random. 
We decided not to collect detailed demographic informations 
about EPW users, since this would be inappropriate for a tool 
that has been advertised to support user’s privacy. Instead, we 
provide technical information such as statistics about the user 
profiles (Table III i to allow the sample bias to be appraised: 


X 

o 

II 

0X 

X 

o-x 

Friends 

0% 

148.75 

96 

159.53 

Photos 

3.43% 

181.69 

32 

572.62 

Labels on photos 

34.45% 

20.54 

3 

64.45 

Photo albums 

3.49% 

10.71 

7 

20.05 

Locations 

17.07% 

38.68 

4 

101.65 

Likes 

10.06% 

90.04 

36 

145.33 

Notes 

86.94% 

1.49 

0 

19.5 


TABLE III 

Basic proeile statistics: percentage oe proeiles without any 

ENTRY IN FIELD X (X = 0) AND THE AVERAGE (0x), MEDIAN (X) AND 
STANDARD DEVIATION (ax) OF THE NUMBER OF ENTRIES IN FIELD X 


Our median user has 96 friends, liked 36 pages and shared 
32 pictures. Many users have just a few friends (Eigurej^ and 
a few of them have plenty of friends. The degree distribution of 
the friendship graph as well as the median number of friends 
is similar to those of the whole Facebook graph l23l . We 
interpret this as an evidence that our FPW users are close to 
normal with respect to the number of friends. 

IV. Global Privacy Evaluation 

In this section, we elaborate which data EPA users upload to 
Eacebook and who is allowed to access it without mentioning 


'http://www.handelsblatt.com/technologie/it-tk/it-intemet/facebook- 
privacy- watcher- im- einsatz- gegen- den- daten- kraken- seite- all/7388782- 
all.html,Accessed2015-03-06 

^ http://www.ffh.de/news-service/magazin/toController/Topic/toAction/ 
show/toId/3371/toTopic/die-facebook-ampel-fuer-sichere-postings.html, 
Accessed2015-03-06 
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Fig. 3. Histogram: number of friends 



Profile field 


Fig. 4. Histogram of the ratio, the user profile fields are filled 


cultural differences amongst users from various countries to 
provide a holistic view. We further quantify the impact of the 
FPW on the privacy settings and compare the standard privacy 
settings in Facebook with the actual user decisions to quantify 
the total demand for modifying the Facebook standard privacy 
setting to meet users’ needs. 

Because of the typical life-cycle of the plug-in instances 


(Section 111-C2 1 , three data views are available; the privacy 
settings before using the plug-in, after using the plug-in and 
the changes that have been made. We avoid the redundancy 
which would be caused by presenting the three possible points 
of view. We instead focus on the settings after applying our 
plug-in and the changes which have been made. 


A. Exposure of User Data 

A Facebook profile can consist of 28 data fields in total. To 
estimate the potential privacy risk, it is crucial to know which 
parts of the profile are filled with data and thus potentially 
exposed to the risk of being accessed by subjects which are 
not part of the set of desired recipients. The average filling 
ratio of the profile fields that allow users to select the audience 
is given in Figure 

The profile fields friend list. Timeline entries, photo albums, 
map entries and notes are lists of items that are technically 
always available. The number of items included in the users 
profiles can be found in Tables IVI] and VII Subscriptions are 
also not included in Figure ffl They allow users to follow 
other users’ updates (e.g. news of famous actors) without 
befriending with them. It is possible to determine the visibility 
of subscriptions without subscribing anything. According to 
our ethical considerations, we only store the visibility of data 
fields but not their content. We thus are not sure whether a 
user subscribed to any newsfeed. 

The fields gender, e-mail and birthday are obligatory to 
create a user profile on Facebook. Hence, every user profile 
encloses this data (not necessarily honest). None of the other 
profile fields are filled by all users. The fields family, current 
city, relationship status, hometown, employer and school are 
filled with data by the majority of users. Only few FPW users 
uploaded skills and phone numbers to Facebook. Please note 


that we can only check whether data is included or not. We 
have no means to verify it. 

B. Visibility of User Profiles Fields 


About you - 
Address - 
Birthday - 
Current city - 
Emails - 
Employer - 
Family - 
Friendiist - 
Hometown - 
Instant messenger - 
Interested in - 
Languages - 
Mobile phones - 
Other phones - 
Photo album - 
Political views - 
Quotations - 
Relationship status - 
Religious views - 
School - 
Subscriptions - 
Timeline-entry - 
University - 
Website - 



I Friends Only me Custom 


Fig. 5. Visibility of user profile fields 


Figure shows the cumulated visibility of the profile fields 
of FPW users. The most popular setting is to share content 
items with all friends. The second most frequently used setting 
is to share items with the public. Sharing bits of information 
with only a subset of friends (’custom’) or hiding them (’only 
me’) is not very popular. 

More than one third of the users do not restrict access to the 
fields: current city, employer, friend list, hometown, languages, 
school and university. These profile fields may help attackers 
to collect sufficient information to deploy social engineering 
attacks. The friend list is especially dangerous to publish, since 
sharing the friend list helps attackers to traverse through the 
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social graph using crawlers. Furthermore, inference attacks 
im are fostered by publishing the friend list. These kinds 
of attacks are based on the assumption that friends share 
similarities (e.g. similar age). An attacker can infer hidden 
profile attributes in case that friendship connections are known 
to the attacker and friends disclose the information of interest. 

The custom setting is used for phone numbers in more than 
95% of those cases where this information is included into 
the user profile. More than a quarter of our study participants 
share the birthday, political views and religious views just 
with a subset of their friends. The fact that a non-negligible 
number of users use the setting ’only me’ is remarkable. It 
makes sense that people disclose information in fields that are 
technically necessary (e.g. the friend list) in case that they 
do not want to share them with others. However, uploading 
other fields to Facebook without sharing it with anybody does 
not help to socialize with others. We assume fields with this 
visibility setting to be a result of increased privacy awareness. 
Previously visible informations seems to be hidden. 


Shared link/post - 
Status update - 
Photo added - 
App on Facebook- 
Post of another user - 
Profile photo changed - 
Cover photo changed - 
Post via external app/website - 
Marked in post - 
Photos added to album - 
Photo of another user - 
Marked in photo - 
Mentioned in post - 
Checkin - 
Add video - 
Like from external page - 
Marked in photo album - 
Comment from external page - 
Created note - 
Changed relationship status - 
Tagged in video - 
Marked in note - 
Marked in life event - 
Question asked - 



n = 33454 
n = 11769 
n = 8411 
n = 3597 
n = 2634 
n = 2361 
n = 1684 
n = 1614 
n = 1592 
n = 1541 
n = 1510 
n = 1449 
n = 851 
n = 767 
n = 499 
n = 308 
n = 259 
n = 141 
n = 81 
n = 70 
n = 70 
n = 22 
n = 13 
n = 4 


0.0 0.2 0.4 0.6 0.8 1.0 


C. Privacy Impact of Simplified Audience Selection 

Many Facebook users are unable to handle the privacy 
settings to meet their own sharing preferences US, m- 
It is hence not sufficient to elaborate the actual privacy 
settings to study the sharing preferences. Since the color¬ 
coding based privacy setting interface is shown to drastically 
decrease mistakes in selecting the audience QSl, elaborating 
the impact of the FPW helps to understand the gap between 
sharing interests and actual privacy settings. 

With the help of our plug-in, 22.31% of the users change 
the visibility to a more restrictive setting, 19.55% of the users 
prefer less restrictive settings and 5.44% keep the average 
privacy by changing the visibility of different items equally 
to both directions. 52.14% of the users do not change the 
profile visibility compared to the settings before installing our 
plug-in. 

The group of users who did not change any setting contains 
many inactive people with small user profiles as well as those 
who sent us feedback during the first session with activated 
FPW. All users who were not able to change any setting 
because of facing technical problems are also part of this 
group. In spite of not changing the settings, some users sent 
us feedback to state that the plug-in is very useful to check 
the settings with very little effort. 


Public - 


Friends - 


Oniy me 



26.5% 

4.4% 

1.5% 






























Public 

Friends 

Only me 

Custom 


To 


Public Friends Only me Custom 

Fig. 6. Privacy settings of timeline entries 

Timeline entries are similar to posts in a newsfeed and can 
have many different types. Figure shows the visibility of all 
types of timeline entries. The main findings are that; 

• the setting ’friend’ is even more dominant than in other 
parts of the profile 

• less entries are visible to the public 

• posts from external pages (e.g. commercial pages) and 
cover photo changes are always public 

• the setting ’only me’ is rarely used in general 

• the most frequently hidden timeline entries are likes from 
external pages, posts from other users and posts from apps 

• photos of other users are often shared with only a subset 
of friends 


Fig. 7. Heat map of visibility levels reflecting visibility change actions, 
performed with the help of the new interface (from, to) 

In the remainder of this section, we focus on users who 
change the visibility of profile fields using the FPW. Figure [7] 
shows a heat map that illustrates change actions with respect to 
the visibility level before and after performing the actions. The 
most frequently performed action is to change the visibility 
from ’public’ to ’friends’. The opposite change action is the 
second most frequently performed action. 

With the help of the FPW, users hide more information 
(’only me’) from public or friends than providing access to 
content. Remarkable is that the custom visibility setting, which 
is explicitly supported by our interface, is more likely to be 
removed than being newly used. Many users seem not to be 
happy to distinguish among different groups of friends. They 
instead prefer to either publish content without restrictions or 
among all friends. 
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Fig. 8. Percentage of users who changed the visibility of certain profile 
fields; only filled fields are mentioned 


D. Comparison with Facebook Standard Privacy Settings 

Advocates of the concept ’privacy by default’ argue that 
people do not tend to change the default settings. Following 
this argumentation, and taking the user’s audience selection 
efforts into account, an interesting question is how the defaults 
should look like to be in line with the user’s needs. We thus 
compare the default settings with the actual privacy settings. 

The Facebook default settings consist of two visibility 
levels: public and friends. The heat map in Figure [T0| shows a 
comparison of the standard settings with the condition before 
applying the changes with the new interface: 43.6% of all 
profile fields, which are shared with public according to the 
Facebook standard, are publicly accessible. 39.2% of these 
public fields have been changed to be accessible only by 
friends. 49.2% of the by default friend-visible profile fields 
are still friend-visible before using the FPW and 38.4% of 
profile of the latter are visible to just a subset of friends. 


Figure depicts the exact percentage of items per profile 
field where users changed the visibility with the FPW. We 
only included those 2816 users whose privacy has finally been 
affected by the FPW. The highest demand for changes can be 
seen in the timeline entries. A user profiles in Facebook can 
enfold plenty of timeline entries but only a single entry in 
many other fields (e.g. birthday). The visibility of the employer 
has been changed by the second largest fraction of users, 
followed by the university and the friend list. 


Timeline-entry - 
Friendlist - 
Employer - 
Current city - 
Relationship status - 
Family - 
Hometown - 
Photo album - 
School - 
Birthday - 
University - 
About you - 
Quotations - 
Religious views - 
Instant messenger - 
Interested in - 
Languages - 
Mobile phones - 
Political views - 
Website - 
Address - 
Emails - 
Other phones - 



n = 7133 
n =835 
n = 433 
n = 422 
n = 401 
n =358 
n = 356 
n = 340 
n = 337 
n =273 
n = 205 
n = 151 
n = 116 
n = 75 
n =73 
n = 70 
n = 58 
n = 58 
n =55 
n = 35 
n = 29 
n = 6 
n = 6 


0.0 0.2 0.4 0.6 0.8 1.0 


^ Public - 

'B 

0) 

<ji 

43.6% 

39.2% 

7.9% 

9.3% 

3 

45 

Q Friends - 

5.7% 

49.2% 

6.8% 

38.4% 


Public Friends Only me Custom 

Before using the add-on 


Fig. 10. Fleat map that illustrates the privacy setting changes from Facebook 
standard (ordinate) to individual settings (abscissa) before using the new 
interface 


Figure 11 illustrates the comparison of standard settings 
with the situation after using the FPW. In spite of many users 
changing profile settings, the cumulated amount of visible 
content does not change dramatically. 21.05% of the users 
used the plug-in to reduce the visibility of data objects in 
average by changing the standard settings. 10.44% changed 
the standard settings to the opposite direction. Our evaluation 
shows that the visibility of profile fields is still conform with 
the standard settings in many cases. 40.56% of the public fields 
are still unchanged after using the plug-in. That is also true 
for 49.93% of the fields which are friend-visible by default. 


Changing the setting: More private Less private 

Fig. 9. Fraction of change actions with the help of the FPW towards more 
or less privacy per profile field 

The tendency of performed changes towards more or less 
privacy in different profile fields is shown in Figure]^ Timeline 
entries, birthdays, about you, quotations, religious views, in¬ 
stant messagers, political views and e-mail addresses are those 
fields where more change actions towards less privacy have 
been performed. The rest of the profile fields are more private 
in average after using the FPW. 


^ Public - 

o 

to 


40.1% 

41.7% 

9.4% 

8.8% 

3 

45 

Q Friends - 


7.0% 

49.1% 

7.7% 

36.2% 


Public Friends Only me Custom 

After using the add-on 


Fig. 11. Heat map that illustrates the privacy setting changes from Facebook 
standard (ordinate) to individual settings (abscissa) after using the new 
interface 
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V. Country-Specific Privacy Evaluations 

Since privacy preferences are depending on cultural back¬ 
grounds of users m, we detail the global evaluations by 
comparing the actual privacy settings as well as the impact 
of the FPW with respect to the user’s country of origin. Due 
to space limitations, we abstain from including every single 
prohle held and concentrate on the examples showing the 
strongest variations. 

As a result of constraints in our dataset, the cross-country 
comparisons suffer from differences in sample sizes. We ad¬ 
dress this issue in the following evaluations by normalizing all 
data and comparing only fractions (proportions) and medians 
which are rather stable with respect to different sample sizes. 
Also, we only include samples which are big enough to be 
stable against outliers and only apply extremely conservative 
statistic testing. Since we used the same method for acquiring 
study participants in all countries, we assume a potential bias 
to equally occur amongst the considered countries. Hence, 
we assume the comparability of our samples from various 
countries to be valid. Germany is a special case since our 
university is well known and receives more attention and trust 
here. 

A. Exposure and Visibility of Personal Data in Different 
Countries 

FPW users from different countries have different sharing 
interests. This can be shown by comparing both: the infor¬ 
mation which is enclosed into the user prohles (hlled helds) 
as well as privacy settings. Figure [T^ shows the cumulated 
differences among the eight countries with feedback of more 
than 50 users. We cumulate all prohle helds of all users in 
the respective country and compare the total proportions of 
content according to their visibility. 


Country 

Country 

W 

p-value 

BH 

Setting 

Egypt 

Austria 

3926 

0.00010 

0.00131 

Friends 

Egypt 

Switzerland 

1613 

0.00015 

0.00131 

Public 

Egypt 

Switzerland 

2380.5 

0.00010 

0.00131 

Friends 

Egypt 

France 

1974.5 

0.00080 

0.00378 

Public 

Egypt 

Netherlands 

1800.5 

0.00039 

0.00221 

Public 

Egypt 

Netherlands 

484 

0.00018 

0.00131 

Friends 

Germany 

USA 

29431 

0.00779 

0.02726 

Only me 

France 

Switzerland 

752.5 

0.00533 

0.02133 

Custom 


TABLE IV 

Subset of significant results of the Pairwise Mann^Whitney U 
TEST OF cumulated THE DATA IN FIGURe[T2 W = TEST STATISTIC; BH 
= Benjamini & Hochberg correction for multiple comparisons 


small to provide meaningful results to include them into this 
paper. 

French users include the highest fraction of content to their 
prohles which is visible for just a subset of their friends. FPW 
users from Germany and the USA show signihcant differences 
in hiding content from others (setting: ’only me’). Many other 
differences can be seen (Figure [T^, but they are not signihcant 
according to our extremely strict criteria. 

We tested the signihcance of country-specihc differences 
by applying the Mann-Whitney U-test (with continuity cor¬ 
rection) on four distinct datasets. We compared (country pair¬ 
wise on user granularity) the country-specihc percentages of 
the user prohle held visibility to be either ’public’, ’only 
friends’, ’only me’ or ’custom’. The Benjamini & Hochberg 
correction El has been applied to adjust p-values for multiple 
comparisons (28 pairwise comparisons). Table |lV|provides the 
results. 

Country-specihc content sharing differences can be even 
stronger realized by comparing the visibility of certain prohle 
helds in different countries. We thus choose a sample of seven 
helds to explain the differences in Figures [1^ till [1^ 



United States 


Netherlands 


France 


Spain 

Egypt 

Germany 

Switzerland 


Austria 


0.0 0.2 0.4 0.6 0.8 1.0 


I Friends Only me Custom 



United States 
Netherlands 
France 
Spain 

Egypt 

Germany 

Switzerland 

Austria 


Condition: ^^Filled ^^Notfilled Public Friends Only me Custom 


Fig. 12. Cumulated privacy settings in different countries; sample sizes can 
be found in Table 1 

The most obvious result in our evaluation is that Egyptian 
users tend to share more information with the public than 
others. The latter also tend to hide the highest fraction of 
information (setting: ’only me’) from anybody. Compared with 
the other seven countries, they tend to either publish content 
or not, rather than sharing with friends. We thus formulate the 
hypothesis that people in Egypt tend to use their Facebook 
prohle as a tool to present themselves rather than to share 
content with their friends. Users from other Arabic countries 
seem to show a similar behavior, but the sample size is too 


Fig. 13. Privacy settings of the field ’languages’ 

Evaluating the languages held (Figure [T3| ), we realized that 
Egyptian users do only rarely include the languages into their 
prohles. However, in case they do, they share this information 
with the public. This is a very different behavior, compared to 
other countries. We would thus suspect Egyptians not to speak 
other languages very often but in case they do, they seem to 
be very proud of it. Spanish users do share the information 
about their languages signihcantly more often than users from 
USA and Austria. That is less signihcant but still valid for 
Swiss users, too. 

Another country-specihc difference in sharing interest can 
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Country 

Country 

W 

p-value 

BH 

Field 

Egypt 

Austria 

213.5 

0.00064 

0.01352 

Lanauaaes 

Egypt 

France 

10.5 

0.00702 

0.01776 

Lanauaaes 

Egypt 

Germany 

4613 

0.00324 

0.01469 

Lanauaaes 

Egypt 

Netherl. 

10.5 

0.00248 

0.01469 

Lanauaaes 

Egypt 

USA 

17.5 

0.00154 

0.0143 

Lanauaaes 

Spain 

Austria 

289 

0.00539 

0.0151 

Lanauaaes 

Spain 

USA 

53 

0.00970 

0.0209 

Lan^ua^es 

Egypt 

Netherl. 

343.5 

0.00097 

0.01352 

Hometown 

Egypt 

Germany 

20119 

0.00357 

0.01469 

Religious V. 

France 

Egypt 

399.5 

0.00407 

0.01469 

Family 

France 

Germany 

22835 

0.00761 

0.01776 

Family 

France 

Netherl. 

495 

0.00499 

0.01508 

Family 

France 

Switzerl. 

316.5 

0.00420 

0.01469 

Family 


TABLE V 

Subset of significant results of the Pairwise Mann-Whitney U 

TEST OF NON-CUMULATED DATA; W = TEST STATISTIC; BH = BENJAMINI 

& Hochberg correction for multiple comparisons 



United States 
Netherlands 
France 
Spain 
Egypt 
Germany 
Switzerland 
Austria 


Condition: ^^Filled ^^Notfilled Public Friends Only me Custom 

Fig. 14. Privacy settings of the field ’hometown’ 



United States 
Netherlands 
France 
Spain 
Egypt 
Germany 
Switzerland 
Austria 


Condition: ^^Fllled ^^Notfilled Public Friends Only me Custom 

Fig. 16. Privacy settings of the field ’family’ 

users prefer to share this information only with friends. In 
comparison to others, French users tend to restrict access to 
this profile field. Remarkable is that this is the field which is 
hidden by the largest fraction of people. 



United States 
Netherlands 
France 
Spain 
Egypt 
Germany 
Switzerland 
Austria 


Condition: ^^Fllled ^^Notfllled Public Friends Only me Custom 

Fig. 17. Privacy settings of the field ’relationship status’ 


be observed at the profile field ’Hometown’ (Figure [T4) i. 
Egyptian FPW users share the name of the hometown with 
a significantly higher probability with the public than FPW 
users from the Netherlands. However, the highest fraction of 
users who added the hometown to the user profile is from 
Spain. 


United States - 
Netherlands - 
France - 
Spain - 
Egypt - 
Germany - 
Switzerland - 
Austria - 



Fig. 15. Privacy settings of the field ’religious views’ 


Comparing the visibility of the relationship status of Spanish 
and Egypt EPW users (Eigure [T7] i is very interesting. Spanish 
EPW users are the subset with the lowest probability of filling 
and publishing the field ’relationship status’. With the highest 
probability compared to others, they share this information 
with only a selected subset of friends. In contrast, nearly half 
of the Egyptians publish their relationship status. At the same 
time, they are also the subset of EPW user with the highest 
likelihood to hide this bit of information. 

The friend list (Eigure 18i is the sole profile field in this 
evaluation which exists in every user profile without being 
empty. Users do not have the choice to upload a friend list or 
not; it is created automatically by adding friends. In case that 
users prefer not to share this information, their only chance 
is to hide the list by choosing the visibility setting ’only 
me’. Accordingly, the latter setting is very popular. This is 
especially true for the subset of Egypt EPW users. 


The religious views (Eigure [T^ are less likely to be included 
in the Eacebook profile of the EPW users than e.g. the 
hometown or the family status. Only among Egyptian users, 
a majority of people can be observed to add the religious 
views to the user profile in Eacebook. Eurthermore, the Egyp¬ 
tians form the group that publishes this information with the 
highest likelihood. This observation can be used to found the 
hypothesis that religious views and their public commitments 
are more important in Egypt than in the other countries that 
we consider in this paper. 

Information about the family status (Eigure [T6| is very likely 
to be included into the profiles. The overwhelming fraction of 


Friendlist 


United States - 
Netherlands - 
France - 
Spain - 
Egypt - 
Germany - 
Switzerland - 
Austria - 



Fig. 18. Privacy settings of the field ’friend list’ 
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B. Country-Specific Changes of Privacy Settings 

In Section V-A| we elaborated the privacy settings in 
different countries and distinguished between different helds. 
The main hnding was that users from different countries share 
different information with their friends or the public. Since all 
users are faced with the same default privacy settings while 
having different sharing desires, the necessity of changing the 
visibility settings to meet the own sharing desires thus also 
differs. In this section, we elaborate the change actions which 
have been performed with the help of the FPW with respect 
to the user’s country of origin. 

In the remainder of this section, we distinguish among 
four subsets of users. The first subset, denoted only less 
private, consists of users who only changed visibility settings 
towards a higher visibility, e.g. from ’friends’ to ’public’ or 
from ’only me’ to ’friends’. The second subset consists of 
users who changed the visibility less private. That means the 
users perform changes in both directions but those changes 
which grant more access to profile fields prevail the others. 
Accordingly, we denote the third and the fourth subset more 
private and only more private were the third subset consists 
of users who mainly changed to a more private setting and 
the fourth subset of users who only restricted access to profile 
helds. 

We ignored two subsets which could be built when fol¬ 
lowing the previous logic; those users who did not change 
anything and those users who changed the privacy settings 
equally to both direction. The latter have been ignored since 
the subset contains many users who only tried our new 
interface and changed one held in both directions. The subset 
of users who did not change anything can hardly be evaluated 
since this subset contains those users who faced technical 
problems, thus unable to perform changes. 


All- 
USA- 
Netherlands - 
France - 
Spain - 
Egypt - 
Germany - 
Switzerland - 
Austria - 

0.00 0,25 0.50 0,75 1,00 


who only used the FPW to change the privacy settings to less 
private settings is relatively high (30.92% of the sum of the 
four clusters). In Spain, the latter is even higher than 50%. In 
total, the FPW caused less information to be accessible. 

Comparing the privacy settings in Figure and the change 
actions in Figure draws a homogeneous picture; The two 
countries with the least conservative settings are those with 
the highest fraction of users in the cluster only less private. 
Switzerland and the Netherlands are at the opposite of the 
range in both illustrations. 


VI. Change Direction Clusters 


The clear distinction of clusters in Figure 19 inspired us 
to evaluate the differences in the user profiles to examine 
implications of privacy preferences on profile properties. In 
Tables [Vl] and |VII| we compare the mean and median of the 
countable prohle properties ’Friends’, ’Likes’, ’Photos’, ’Map 
Entries’ and ’Notes’ with respect to clusters and countries. 

Users in the cluster only more private have more friends 
(median) than others but less likes and less map entries. Users 
in the cluster more private still have more friends than those 
who used the FPW to increase the visibility of profile helds. 
Also notable is that users in the cluster only less private do 
not mind to tell Facebook their location by having more map 
entries. Notes are not very popular amongst our set of users. 
The mean of 19.87 in the more private cluster is a result of a 
fringe group of users having plenty of notes. 

Table IVIII shows the mean and the median of the same 
set of countable prohle properties as they can be found in 


Table VI Obvious differences among country clusters are that 
Egyptian EPW users who sent us feedback have more friends 
and more likes than all others. The cluster of Dutch EPW users 
is the opposite extreme, having 18 times less likes (median) 
than Egyptian cluster. The Spanish users share 60 pictures, the 
German 2 (median). 

Suddenly, comparing the differences amongst our four 
change direction clusters in Table |Vl] exhibits notably smaller 
differences than comparing user prohle differences amongst 
users from different countries in Table IVIII All values in Table 
are very close to the values in the line ’Germany’ in Table 
The reason is that the majority of the EPW users in this 


VI 


VI 


study is German. It underlines the inhuence factor country of 
origin to dominate the change direction. 


^Jonly less private ^Jviore private 
Less private Only more private 

Eig. 19. Eractions of users grouped by change directions of actions with 
FPW 

Eigure shows the distribution of the four clusters in 
our top eight countries. The relative cluster sizes are different 
amongst the mentioned countries and the majority of the EPW 
users changes the visibility of prohle helds towards one of the 
two possible directions. Surprisingly, in spite of advertising 
the EPW as a tool to increase the privacy, the fraction of users 


VII. Summary and Conclusion 

In this paper, we presented the hrst large-scale study about 
content sharing and privacy preferences of Eacebook users 
with special focus on country-specihc characteristics. It is 
based on 9,292 feedbacks from 4,182 users in 102 countries. 
Our sample is neither complete nor a result of a random 
sampling process (Section 0- Yet, the huge media attention 
from radio stations and daily newspapers, which address 
ordinary people, shows that the EPW was assumed to be 
interesting for their recipients. Eurthermore, the fact that a 
very big fraction of users discloses more information instead 
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Friends 


Likes 


Photos 


Notes 


Cluster 


Map entries 



Mean 

Median 

Mean 

Median 

Mean 

Median 

Mean 

Median 

Mean 

Median 

Only more private 

171.48 

112 

106.03 

39 

22.34 

3 

38.69 

4 

0.48 

0 

More private 

163.64 

107 

131.69 

49 

19.16 

3 

46.95 

4 

19.87 

0 

Less private 

177.11 

88 

142.58 

49 

28.81 

2 

49.87 

7 

1.86 

0 

Only less private 

186.49 

91 

125.69 

55 

22.69 

4 

98.32 

11 

0.71 

0 


TABLE VI 

Profile statistic comparison with respect to change direction clusters 


Country 

Friends 

Mean Median 

Likes 

Mean Median 

Photos 

Mean Median 

Map entries 

Mean Median 

Notes 

Mean Median 


United States 

201.41 

115 

156.47 

73 

45.64 

8 

24.68 

4 

1.93 

0 


Netherlands 

111.63 

90 

33.50 

10 

17.70 

8 

47.73 

21 

0.03 

0 


France 

267.81 

112 

129.22 

44 

47.78 

10 

82.63 

5 

30.86 

0 


Spain 

148.78 

117 

127.97 

23 

98.37 

60 

102.05 

7 

2.94 

0 


Egypt 

331.86 

150 

455.70 

181 

61.86 

17 

25.29 

2 

7.93 

8 


Germany 

154.54 

93 

102.22 

35 

15.38 

2 

45.61 

4 

0.52 

0 


Switzerland 

225.52 

131 

185.41 

40 

28.30 

6 

67.48 

9 

50.58 

0 


Austria 

275.83 

193 

171.46 

96 

36.55 

16 

108.91 

5 

1.60 

0 



TABLE VII 

Profile statistic comparison with respect to countries 


of hiding it with the FPW is a strong evidence that it is not 
used by a fringe group of privacy savvy people. 

In contrast to related work in the field of privacy prefer¬ 
ences, we collect our data on the users’ clients and evaluate 
the behavior from real users who perform audience selection 
on their own user profiles for their own reasons. However, even 
the evaluation of the actual privacy settings is only a rough 
estimation of the sharing preferences that suffers from two 
imprecisions: (i) Many users are unable to properly choose 
their audience with Facebook’s privacy setting interface, and 
(ii) the sharing preferences exhibit a vast diversity depending 
on the user’s country of origin. 

To overcome those imprecisions, we evaluated changes that 
have been made using color-coding based privacy controls. 
In a previous study, the latter have been demonstrated to be 
usable, intuitive and effective to drastically reduce errors and 
efforts in selecting the audience csi. 

We further elaborated the country-specific differences in 
both the privacy settings as well as the privacy change actions. 
Additionally, a cluster analysis highlights the relation between 
the impact of the FPW on users’ audience selection decisions 
and their countable profile properties. 

When creating an account in Facebook, it is obligatory to 
reveal information about gender, e-mail and birthday while 
creating an account on Facebook. However, our results indicate 
that the majority of FPW users sufficiently trusts Facebook 
to confide personal information such as family status, current 
city, hometown, employer and school. Contrariwise, only a mi¬ 
nority of FPW users includes information on skills, addresses 
or political views into their profiles. 

The most popular audience selection strategy is to allow 


all friends to access a certain bit of information, followed by 
publishing it and disclosing it to only a subset of friends. 
The setting ’only me’ is the least popular setting. Beside 
unpopular features such as subscriptions and websites, the 
current city, the hometown, languages and the employees are 
the most frequently published bits. Only very few FPW users 
publish their e-mail address, instant messenger ID and their 
birthday, but the majority shares these bits with their friends. 
The friend list is a divisive issue amongst users to decide about 
its audience. Being published by more than one third of all 
FPW users, the friend list is the profile field that the second 
largest fraction of users is hiding (setting ’only me’). 

Introducing the comprehensible color-coding interface of 
the FPW impacts the audience selection of users. In spite of 
the FPW being advertised as a privacy tool, users disclose 
selected bits of information to the public and to the complete 
set of friends. Users mainly change the privacy settings for 
timeline entries, the friend list and the profile field ’employer’. 
While the visibility of the timeline entries and the field 
employer are roughly equally switched to more and less 
restrictive privacy settings, the friend list setting was preferred 
to be more restrictive by 83% of our participants. The total 
amount of content which is visible to Facebook users does 
not dramatically decrease after introducing a comprehensible 
visualization of privacy controls, but the composition of the 
visible content changes. This indicates that the usability of 
Facebook’s privacy setting interface can be improved by using 
color codings. 

Which information is uploaded to Facebook as well as 
which information is shared with whom is strongly depending 
on the user’s country of origin. A perspicuous example is that 
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less than 22% of the German FPW users shared their religious 
views on Facebook while the majority of Egyptian FPW users 
included their religious views into their user profiles. The 
visibility is chosen accordingly. Thus, global default privacy 
settings cannot meet the sharing interests of all users since 
the sharing interests show country-specific as well as person- 
specific differences. 

Authors of alternative OSN architectures argue that fine¬ 
grained access control is an important feature to improve 
privacy in OSNs ID, EOl . 151 . However, our FPW users tend 
to remove group settings and individual access rules to achieve 
a lower complexity of access rules. We construe this fact to 
express user’s favor for simplicity and thus encourage privacy 
interface designers to focus on simplicity rather than on a rich 
set of functionality. 
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